See: unknown_html malware detected Clean mX Viruswatch - http://support.clean-mx.de/clean-mx/viruses.php?review=159.253.142.194&sort=id%20DESC avast detects as JS:HideLink-A [Trj] : https://www.virustotal.com/nl/file/996a7de72267a44a531a4cd253faebf9b2fded61e0fb533f0bcb6452ab24aafc/analysis/
6 instances of SEO Spam detected: Known javascript malware. Details: http://sucuri.net/malware/entry/MW:SPAM:SEO?g12
t=‘’;}}x[l-a]=z;}document.write(‘<’+x[0]+’ ‘+x[4]+’>.‘+x[2]+’{‘+x[1]+’}</‘+x[0]+’>');}dnnViewState();
Web application version:
Joomla Version 1.5.18 - 1.5.26 for: htxp://perfecthealthherbalng.com/media/system/js/caption.js
Joomla Version 1.5.18 to 1.5.26 for: htxp://perfecthealthherbalng.com/language/en-GB/en-GB.ini
Joomla version outdated: Upgrade required.
cPanel version 11.40.1.11 outdated: Upgrade required.
Outdated Joomla Found: Joomla under 2.5.26 or 3.3.5
Outdated cPanel Found: cPanel 11.40.1.11
Outdated Web Server Apache Found: Apache/2.2.25
Malicious external element detected: htxp://www.khawaib.co.uk/joomla/downloads/item/12-facebook-fanbox.html
See: 6fed838ff983056091608069f5bac0ba487f3bdf
Above link for security researchers only, open up with NoScript extension active and browser inside a VM/sandbox.
Potentially suspicious code detected: 1. /modules/mod_flying_tweets/js/chili-1.7.pack.js
Severity: Potentially Suspicious
Reason: Detected potentially suspicious content.
Details: Detected potentially suspicious initialization of function pointer to JavaScript method eval __tmpvar1959009192 = eval;
Excessive server header info proliferation: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 ?
Security Header Configuration Insecurities and Best Policies Not Followed, view recommendations: http://www.uploady.com/#!/download/YySAXPRNOrZ/aQ8KzCNEJ8aksfCo
http://vel.joomla.org/articles/844-spotting-spam-code-in-malicious-extensions →
view code → http://www.uploady.com/#!/download/J0Dms9nP8Ma/Q16~i8b2zjSVYAY_
streamer php_folder code vulnerable to worms!
View code: http://www.uploady.com/#!/download/Z9RIsHaMh99/l5~1VGjWkOVEL2iO
2. /#
Severity: Potentially Suspicious
Reason: Detected PDF file containing potentially suspicious instructions
Details: Detected hidden CSS declaration
- /index.html
Severity: Potentially Suspicious
Reason: Detected PDF file containing potentially suspicious instructions
Details: Detected hidden CSS declaration
<style>.npliqjmkho{position:absolute;left:-1816px;}</style>
Verdict - no wonder this site stands open to abuse! Avast keeps our users protected detecting this site for what it is.
polonus
(volunteer website security analyst and website error-hunter)